US 12,367,241 B2
System and techniques for enriching log records with fields from other log records in structured format
Satinder Singh, Uttar Pradesh (IN); Kiran Palukuri, Karnataka (IN); Jerry Russell, Seattle, WA (US); and Pankaj Agrawal, Telangana (IN)
Assigned to Oracle International Corporation, Redwood Shores, CA (US)
Filed by Oracle International Corporation, Redwood Shores, CA (US)
Filed on Aug. 10, 2023, as Appl. No. 18/448,058.
Claims priority of provisional application 63/450,927, filed on Mar. 8, 2023.
Prior Publication US 2024/0303273 A1, Sep. 12, 2024
Int. Cl. G06F 16/81 (2019.01); G06F 16/17 (2019.01)
CPC G06F 16/81 (2019.01) [G06F 16/1734 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
accessing a plurality of log records, each of the plurality of log records including data that accords with a particular data structure, wherein:
the plurality of log records have a particular order,
the plurality of log records are associated with a particular client, and
the particular data structure is a hierarchical structure;
extracting a set of individual log records from the plurality of log records, wherein each of the set of individual log records is at a same level within a hierarchy defined for the particular data structure;
identifying, via an automated pattern detection technique, a first syntax of header messages based on the data corresponding to the particular client;
identifying, via the automated pattern detection technique, a second syntax of detail messages based on the data corresponding to the particular client, wherein the automated pattern detection technique detects differences between the first syntax and the second syntax based on labels associated with the data corresponding to the particular client;
automatically detecting, via a first parser of one or more parsers, that each of a first subset of the set of individual log records includes header information based on the first syntax of the header messages;
automatically detecting, via a second parser of the one or more parsers, that each of a second subset of the set of individual log records includes detail information based on the second syntax of the detail messages;
determining, for a particular detail message in the second subset, that header information from at least one header message in the first subset of the set of individual log records is associated with detail information in the particular detail message, wherein the determination is based on establishing a header-detail relationship via a function on at least part of the particular order;
adding, via the function, the header information in the at least one header message to the particular detail message based on the header-detail relationship to enrich the particular detail message; and
displaying the enriched particular detail message on a user interface for data processing, wherein the user interface includes a log search facility, one or more dashboards or applications for analyzing the enriched particular detail message, and wherein the data processing is configured to automatically retrieve enriched detail messages that are associated with the header information in the at least one header message through a single search via the log search facility.